@rebasepro/cli 0.21.2-canary.g1ea48be → 0.23.0

package/dist/{pull-Bj0XnH5s.js → pull-Dywm5FWP.js}

@@ -181,16 +181,52 @@ function restoreArgs(plan, dumpFile) {
 		dumpFile
 	];
 }
-/** Is `pg_dump` on PATH, and what version? Checked before anything destructive. */
-async function findPgDump() {
+/**
+* Is this PostgreSQL client tool on PATH, and what version? Both are checked
+* before anything destructive: discovering `pg_restore` is missing after the
+* dump has been taken — or after `--clean` has emptied the target — is the
+* worst possible ordering.
+*/
+async function findPgTool(tool) {
 	try {
-		const { stdout } = await execa("pg_dump", ["--version"]);
+		const { stdout } = await execa(tool, ["--version"]);
 		return stdout.trim();
 	} catch {
 		return null;
 	}
 }
+/**
+* What a finished `pg_restore` says about the copy.
+*
+* `--clean` empties the target before anything is written, so every way this
+* can end short of exit 0 leaves a partial or empty local database, and none of
+* them may be reported as a copy. A non-zero exit is pg_restore saying it
+* skipped statements — "errors ignored on restore: N" — and whatever those
+* statements created (a table, its rows, an RLS policy) is missing locally.
+*
+* `started` says whether anything can have arrived, which is what decides
+* whether an anonymization pass still has data to redact.
+*/
+function restoreOutcome(run) {
+	if (run.signal) return {
+		started: true,
+		failure: `pg_restore was stopped by ${run.signal} before it finished.`
+	};
+	if (run.exitCode === void 0) return {
+		started: false,
+		failure: `pg_restore could not be started (${run.code ?? "unknown error"}).`
+	};
+	if (run.exitCode === 0) return {
+		started: true,
+		failure: null
+	};
+	const ignored = /errors ignored on restore: (\d+)/.exec(run.stderr ?? "");
+	return {
+		started: true,
+		failure: ignored ? `pg_restore could not restore ${ignored[1]} object(s) — the errors are above.` : `pg_restore exited with code ${run.exitCode}.`
+	};
+}
 //#endregion
-export { anonymizeStatements, describeTarget, dumpArgs, findPgDump, provisionableSchemas, restoreArgs };
+export { anonymizeStatements, describeTarget, dumpArgs, findPgTool, provisionableSchemas, restoreArgs, restoreOutcome };
 
-//# sourceMappingURL=pull-Bj0XnH5s.js.map
+//# sourceMappingURL=pull-Dywm5FWP.js.map

package/dist/{pull-Bj0XnH5s.js.map → pull-Dywm5FWP.js.map}

@@ -1 +1 @@
-{"version":3,"file":"pull-Bj0XnH5s.js","names":[],"sources":["../src/dev-db/pull.ts"],"sourcesContent":["/**\n * `rebase db pull` — copy a database's contents into local development.\n *\n * The common case is production into local, and the reason it exists is that\n * the alternative is worse: without it people hand-roll a `pg_dump | psql` and\n * get the flags wrong in ways that either fail loudly at 2am or, more often,\n * quietly restore half a schema.\n *\n * Three things this command insists on, because copying a production database\n * onto a laptop is a data-protection event whether or not anyone calls it one:\n *\n * 1. **It says what it is about to do, in full, before doing it** — which\n *    database it will read, which one it will overwrite, and where the data will\n *    come to rest on disk. The target path matters: people forget that\n *    `.rebase/pgdata` is a directory their backup software may be indexing.\n *\n * 2. **It refuses to run unattended without being told to.** The target is\n *    destroyed, so a mistyped `--from` with no confirmation would take the\n *    developer's working database with it.\n *\n * 3. **It will not write to a remote database.** The target is always the local\n *    development database; there is no flag that makes this push. A tool that\n *    can copy in both directions eventually copies in the wrong one.\n *\n * Anonymization is opt-in (`--anonymize`), which is a deliberate choice and not\n * an obviously safe one — the flag nobody types is the flag nobody gets. It is\n * a best-effort pass over columns whose *names* look like personal data, and\n * {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in\n * a column called `notes`, and this file says so rather than implying a\n * guarantee it cannot keep.\n */\n\nimport { execa } from \"execa\";\n\n/**\n * Column-name patterns the anonymizer overwrites.\n *\n * Names, not contents: inspecting values would be slower, and would still miss\n * the same things. This is a reasonable-effort measure for making a local copy\n * less dangerous, and it is not a compliance control.\n */\nexport const ANONYMIZE_PATTERNS: readonly { pattern: RegExp; replacement: string }[] = [\n    { pattern: /^(.*_)?e?mail(_.*)?$/i, replacement: \"concat('user', id::text, '@example.invalid')\" },\n    { pattern: /^(.*_)?(phone|mobile|tel|telephone)(_.*)?$/i, replacement: \"'+10000000000'\" },\n    { pattern: /^(.*_)?(first_name|last_name|full_name|surname|given_name)(_.*)?$/i, replacement: \"'Redacted'\" },\n    { pattern: /^(.*_)?(address|street|postcode|zip|zipcode)(_.*)?$/i, replacement: \"'Redacted'\" },\n    { pattern: /^(.*_)?(ssn|tax_id|national_id|passport)(_.*)?$/i, replacement: \"'REDACTED'\" },\n    { pattern: /^(.*_)?(password|password_hash|secret|token|api_key|access_token|refresh_token)(_.*)?$/i, replacement: \"'REDACTED'\" },\n    { pattern: /^(.*_)?(ip|ip_address|user_agent)(_.*)?$/i, replacement: \"'REDACTED'\" }\n];\n\nexport function shouldAnonymize(columnName: string): boolean {\n    return ANONYMIZE_PATTERNS.some((rule) => rule.pattern.test(columnName));\n}\n\nexport function replacementFor(columnName: string): string | null {\n    return ANONYMIZE_PATTERNS.find((rule) => rule.pattern.test(columnName))?.replacement ?? null;\n}\n\n/** A text-ish column the anonymizer can overwrite without a type error. */\nexport interface ColumnRef {\n    schema: string;\n    table: string;\n    column: string;\n    dataType: string;\n}\n\n/**\n * Anonymizable columns: name looks personal, and the type can hold the\n * replacement.\n *\n * The type check is what stops this generating `UPDATE … SET user_id =\n * 'Redacted'` for an integer column called `user_id_email_seq` and failing the\n * whole pass on a technicality.\n */\nexport function anonymizableColumns(columns: readonly ColumnRef[]): ColumnRef[] {\n    const textual = new Set([\"text\", \"character varying\", \"varchar\", \"character\", \"char\", \"citext\"]);\n\n    return columns.filter((column) => shouldAnonymize(column.column) && textual.has(column.dataType.toLowerCase()));\n}\n\n/** `UPDATE` statements for one anonymization pass, in a stable order. */\nexport function anonymizeStatements(columns: readonly ColumnRef[]): string[] {\n    const byTable = new Map<string, ColumnRef[]>();\n    for (const column of anonymizableColumns(columns)) {\n        const key = `${column.schema}.${column.table}`;\n        byTable.set(key, [...(byTable.get(key) ?? []), column]);\n    }\n\n    return [...byTable.entries()]\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([table, cols]) => {\n            const assignments = [...cols]\n                .sort((a, b) => a.column.localeCompare(b.column))\n                .map((column) => `\"${column.column}\" = ${replacementFor(column.column)}`)\n                .join(\", \");\n\n            return `UPDATE ${table.split(\".\").map((part) => `\"${part}\"`).join(\".\")} SET ${assignments};`;\n        });\n}\n\n/**\n * Schemas the restored copy needs the app role provisioned on.\n *\n * `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives\n * with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no\n * privileges behind them. Measured on a 30-table project: 68 policies restored,\n * 14 tables with RLS on, and **0** grants to `rebase_user` — where the source\n * had 60. Reading one table as the role Rebase serves every request through:\n *\n *     source:  6\n *     copy:    ERROR: permission denied for table leads\n *\n * The dump flags are right and stay: without `--no-owner`/`--no-privileges`\n * every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails\n * against roles that do not exist on a laptop, and buries the real output. The\n * repair belongs after the restore, and belongs to `ensureAppRole` — the same\n * routine boot and `rebase db push` call — rather than to a second list of\n * grants written here.\n *\n * Which schemas: every non-system schema the restored database actually has.\n * Boot knows its `managedSchemas` from the collections; a restore knows only\n * what arrived, and a source may carry schemas this project does not declare.\n * `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to\n * grant on and PostgreSQL would refuse anyway.\n */\nexport function provisionableSchemas(rows: readonly { schema: string }[]): string[] {\n    const skip = (name: string) => name === \"information_schema\" || name.startsWith(\"pg_\");\n\n    return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();\n}\n\n/** Host and database of a connection string, with no credentials in it. */\nexport function describeTarget(connectionString: string): string {\n    try {\n        const url = new URL(connectionString);\n        const database = url.pathname.replace(/^\\//, \"\") || \"(default)\";\n\n        return `${url.hostname}${url.port ? `:${url.port}` : \"\"}/${database}`;\n    } catch {\n        // Never echo the raw string: it carries a password, and this line is\n        // printed to a terminal people paste into issues.\n        return \"(unparseable connection string)\";\n    }\n}\n\nexport interface PullPlan {\n    /** Where the data comes from. */\n    source: string;\n    /** Where it lands. Always local. */\n    target: string;\n    anonymize: boolean;\n    /** Schemas to copy. Empty means every non-system schema. */\n    schemas: string[];\n}\n\n/**\n * `pg_dump` arguments for the source.\n *\n * `--no-owner` and `--no-acl` because the roles on a production server do not\n * exist locally, and without them every `ALTER … OWNER TO` in the dump fails and\n * buries the real output in noise. `--format=custom` so `pg_restore` can be told\n * to continue past errors selectively rather than all-or-nothing.\n */\nexport function dumpArgs(plan: PullPlan): string[] {\n    const args = [\"--format=custom\", \"--no-owner\", \"--no-acl\", \"--no-privileges\"];\n    for (const schema of plan.schemas) args.push(\"--schema\", schema);\n    args.push(\"--dbname\", plan.source);\n\n    return args;\n}\n\n/**\n * `pg_restore` arguments for the target.\n *\n * `--clean --if-exists` because a pull replaces what is there: restoring into a\n * database that already has the tables would otherwise fail on every one of\n * them. `--no-owner` for the same reason as the dump.\n */\nexport function restoreArgs(plan: PullPlan, dumpFile: string): string[] {\n    return [\"--clean\", \"--if-exists\", \"--no-owner\", \"--no-privileges\", \"--dbname\", plan.target, dumpFile];\n}\n\n/** Is `pg_dump` on PATH, and what version? Checked before anything destructive. */\nexport async function findPgDump(): Promise<string | null> {\n    try {\n        const { stdout } = await execa(\"pg_dump\", [\"--version\"]);\n\n        return stdout.trim();\n    } catch {\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,qBAA0E;CACnF;EAAE,SAAS;EAAyB,aAAa;CAA+C;CAChG;EAAE,SAAS;EAA+C,aAAa;CAAiB;CACxF;EAAE,SAAS;EAAsE,aAAa;CAAa;CAC3G;EAAE,SAAS;EAAwD,aAAa;CAAa;CAC7F;EAAE,SAAS;EAAoD,aAAa;CAAa;CACzF;EAAE,SAAS;EAA2F,aAAa;CAAa;CAChI;EAAE,SAAS;EAA6C,aAAa;CAAa;AACtF;AAEA,SAAgB,gBAAgB,YAA6B;CACzD,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC;AAC1E;AAEA,SAAgB,eAAe,YAAmC;CAC9D,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC,CAAC,EAAE,eAAe;AAC5F;;;;;;;;;AAkBA,SAAgB,oBAAoB,SAA4C;CAC5E,MAAM,0BAAU,IAAI,IAAI;EAAC;EAAQ;EAAqB;EAAW;EAAa;EAAQ;CAAQ,CAAC;CAE/F,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,SAAS,YAAY,CAAC,CAAC;AAClH;;AAGA,SAAgB,oBAAoB,SAAyC;CACzE,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC/C,MAAM,MAAM,GAAG,OAAO,OAAO,GAAG,OAAO;EACvC,QAAQ,IAAI,KAAK,CAAC,GAAI,QAAQ,IAAI,GAAG,KAAK,CAAC,GAAI,MAAM,CAAC;CAC1D;CAEA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,OAAO,UAAU;EACpB,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,CACxB,MAAM,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC,CAAC,CAChD,KAAK,WAAW,IAAI,OAAO,OAAO,MAAM,eAAe,OAAO,MAAM,GAAG,CAAC,CACxE,KAAK,IAAI;EAEd,OAAO,UAAU,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,OAAO,YAAY;CAC9F,CAAC;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,MAA+C;CAChF,MAAM,QAAQ,SAAiB,SAAS,wBAAwB,KAAK,WAAW,KAAK;CAErF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;AAC1F;;AAGA,SAAgB,eAAe,kBAAkC;CAC7D,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,MAAM,WAAW,IAAI,SAAS,QAAQ,OAAO,EAAE,KAAK;EAEpD,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,GAAG;CAC/D,QAAQ;EAGJ,OAAO;CACX;AACJ;;;;;;;;;AAoBA,SAAgB,SAAS,MAA0B;CAC/C,MAAM,OAAO;EAAC;EAAmB;EAAc;EAAY;CAAiB;CAC5E,KAAK,MAAM,UAAU,KAAK,SAAS,KAAK,KAAK,YAAY,MAAM;CAC/D,KAAK,KAAK,YAAY,KAAK,MAAM;CAEjC,OAAO;AACX;;;;;;;;AASA,SAAgB,YAAY,MAAgB,UAA4B;CACpE,OAAO;EAAC;EAAW;EAAe;EAAc;EAAmB;EAAY,KAAK;EAAQ;CAAQ;AACxG;;AAGA,eAAsB,aAAqC;CACvD,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,WAAW,CAAC,WAAW,CAAC;EAEvD,OAAO,OAAO,KAAK;CACvB,QAAQ;EACJ,OAAO;CACX;AACJ"}
+{"version":3,"file":"pull-Dywm5FWP.js","names":[],"sources":["../src/dev-db/pull.ts"],"sourcesContent":["/**\n * `rebase db pull` — copy a database's contents into local development.\n *\n * The common case is production into local, and the reason it exists is that\n * the alternative is worse: without it people hand-roll a `pg_dump | psql` and\n * get the flags wrong in ways that either fail loudly at 2am or, more often,\n * quietly restore half a schema.\n *\n * Three things this command insists on, because copying a production database\n * onto a laptop is a data-protection event whether or not anyone calls it one:\n *\n * 1. **It says what it is about to do, in full, before doing it** — which\n *    database it will read, which one it will overwrite, and where the data will\n *    come to rest on disk. The target path matters: people forget that\n *    `.rebase/pgdata` is a directory their backup software may be indexing.\n *\n * 2. **It refuses to run unattended without being told to.** The target is\n *    destroyed, so a mistyped `--from` with no confirmation would take the\n *    developer's working database with it.\n *\n * 3. **It will not write to a remote database.** The target is always the local\n *    development database; there is no flag that makes this push. A tool that\n *    can copy in both directions eventually copies in the wrong one.\n *\n * Anonymization is opt-in (`--anonymize`), which is a deliberate choice and not\n * an obviously safe one — the flag nobody types is the flag nobody gets. It is\n * a best-effort pass over columns whose *names* look like personal data, and\n * {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in\n * a column called `notes`, and this file says so rather than implying a\n * guarantee it cannot keep.\n */\n\nimport { execa } from \"execa\";\n\n/**\n * Column-name patterns the anonymizer overwrites.\n *\n * Names, not contents: inspecting values would be slower, and would still miss\n * the same things. This is a reasonable-effort measure for making a local copy\n * less dangerous, and it is not a compliance control.\n */\nexport const ANONYMIZE_PATTERNS: readonly { pattern: RegExp; replacement: string }[] = [\n    { pattern: /^(.*_)?e?mail(_.*)?$/i, replacement: \"concat('user', id::text, '@example.invalid')\" },\n    { pattern: /^(.*_)?(phone|mobile|tel|telephone)(_.*)?$/i, replacement: \"'+10000000000'\" },\n    { pattern: /^(.*_)?(first_name|last_name|full_name|surname|given_name)(_.*)?$/i, replacement: \"'Redacted'\" },\n    { pattern: /^(.*_)?(address|street|postcode|zip|zipcode)(_.*)?$/i, replacement: \"'Redacted'\" },\n    { pattern: /^(.*_)?(ssn|tax_id|national_id|passport)(_.*)?$/i, replacement: \"'REDACTED'\" },\n    { pattern: /^(.*_)?(password|password_hash|secret|token|api_key|access_token|refresh_token)(_.*)?$/i, replacement: \"'REDACTED'\" },\n    { pattern: /^(.*_)?(ip|ip_address|user_agent)(_.*)?$/i, replacement: \"'REDACTED'\" }\n];\n\nexport function shouldAnonymize(columnName: string): boolean {\n    return ANONYMIZE_PATTERNS.some((rule) => rule.pattern.test(columnName));\n}\n\nexport function replacementFor(columnName: string): string | null {\n    return ANONYMIZE_PATTERNS.find((rule) => rule.pattern.test(columnName))?.replacement ?? null;\n}\n\n/** A text-ish column the anonymizer can overwrite without a type error. */\nexport interface ColumnRef {\n    schema: string;\n    table: string;\n    column: string;\n    dataType: string;\n}\n\n/**\n * Anonymizable columns: name looks personal, and the type can hold the\n * replacement.\n *\n * The type check is what stops this generating `UPDATE … SET user_id =\n * 'Redacted'` for an integer column called `user_id_email_seq` and failing the\n * whole pass on a technicality.\n */\nexport function anonymizableColumns(columns: readonly ColumnRef[]): ColumnRef[] {\n    const textual = new Set([\"text\", \"character varying\", \"varchar\", \"character\", \"char\", \"citext\"]);\n\n    return columns.filter((column) => shouldAnonymize(column.column) && textual.has(column.dataType.toLowerCase()));\n}\n\n/** `UPDATE` statements for one anonymization pass, in a stable order. */\nexport function anonymizeStatements(columns: readonly ColumnRef[]): string[] {\n    const byTable = new Map<string, ColumnRef[]>();\n    for (const column of anonymizableColumns(columns)) {\n        const key = `${column.schema}.${column.table}`;\n        byTable.set(key, [...(byTable.get(key) ?? []), column]);\n    }\n\n    return [...byTable.entries()]\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([table, cols]) => {\n            const assignments = [...cols]\n                .sort((a, b) => a.column.localeCompare(b.column))\n                .map((column) => `\"${column.column}\" = ${replacementFor(column.column)}`)\n                .join(\", \");\n\n            return `UPDATE ${table.split(\".\").map((part) => `\"${part}\"`).join(\".\")} SET ${assignments};`;\n        });\n}\n\n/**\n * Schemas the restored copy needs the app role provisioned on.\n *\n * `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives\n * with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no\n * privileges behind them. Measured on a 30-table project: 68 policies restored,\n * 14 tables with RLS on, and **0** grants to `rebase_user` — where the source\n * had 60. Reading one table as the role Rebase serves every request through:\n *\n *     source:  6\n *     copy:    ERROR: permission denied for table leads\n *\n * The dump flags are right and stay: without `--no-owner`/`--no-privileges`\n * every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails\n * against roles that do not exist on a laptop, and buries the real output. The\n * repair belongs after the restore, and belongs to `ensureAppRole` — the same\n * routine boot and `rebase db push` call — rather than to a second list of\n * grants written here.\n *\n * Which schemas: every non-system schema the restored database actually has.\n * Boot knows its `managedSchemas` from the collections; a restore knows only\n * what arrived, and a source may carry schemas this project does not declare.\n * `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to\n * grant on and PostgreSQL would refuse anyway.\n */\nexport function provisionableSchemas(rows: readonly { schema: string }[]): string[] {\n    const skip = (name: string) => name === \"information_schema\" || name.startsWith(\"pg_\");\n\n    return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();\n}\n\n/** Host and database of a connection string, with no credentials in it. */\nexport function describeTarget(connectionString: string): string {\n    try {\n        const url = new URL(connectionString);\n        const database = url.pathname.replace(/^\\//, \"\") || \"(default)\";\n\n        return `${url.hostname}${url.port ? `:${url.port}` : \"\"}/${database}`;\n    } catch {\n        // Never echo the raw string: it carries a password, and this line is\n        // printed to a terminal people paste into issues.\n        return \"(unparseable connection string)\";\n    }\n}\n\nexport interface PullPlan {\n    /** Where the data comes from. */\n    source: string;\n    /** Where it lands. Always local. */\n    target: string;\n    anonymize: boolean;\n    /** Schemas to copy. Empty means every non-system schema. */\n    schemas: string[];\n}\n\n/**\n * `pg_dump` arguments for the source.\n *\n * `--no-owner` and `--no-acl` because the roles on a production server do not\n * exist locally, and without them every `ALTER … OWNER TO` in the dump fails and\n * buries the real output in noise. `--format=custom` so `pg_restore` can be told\n * to continue past errors selectively rather than all-or-nothing.\n */\nexport function dumpArgs(plan: PullPlan): string[] {\n    const args = [\"--format=custom\", \"--no-owner\", \"--no-acl\", \"--no-privileges\"];\n    for (const schema of plan.schemas) args.push(\"--schema\", schema);\n    args.push(\"--dbname\", plan.source);\n\n    return args;\n}\n\n/**\n * `pg_restore` arguments for the target.\n *\n * `--clean --if-exists` because a pull replaces what is there: restoring into a\n * database that already has the tables would otherwise fail on every one of\n * them. `--no-owner` for the same reason as the dump.\n */\nexport function restoreArgs(plan: PullPlan, dumpFile: string): string[] {\n    return [\"--clean\", \"--if-exists\", \"--no-owner\", \"--no-privileges\", \"--dbname\", plan.target, dumpFile];\n}\n\n/**\n * Is this PostgreSQL client tool on PATH, and what version? Both are checked\n * before anything destructive: discovering `pg_restore` is missing after the\n * dump has been taken — or after `--clean` has emptied the target — is the\n * worst possible ordering.\n */\nexport async function findPgTool(tool: \"pg_dump\" | \"pg_restore\"): Promise<string | null> {\n    try {\n        const { stdout } = await execa(tool, [\"--version\"]);\n\n        return stdout.trim();\n    } catch {\n        return null;\n    }\n}\n\n/** The fields of a finished `pg_restore` run that decide {@link restoreOutcome}. */\nexport interface RestoreRun {\n    exitCode?: number;\n    signal?: string;\n    /** A spawn failure's code — `ENOENT` when the binary vanished. */\n    code?: string;\n    stderr?: string;\n}\n\n/**\n * What a finished `pg_restore` says about the copy.\n *\n * `--clean` empties the target before anything is written, so every way this\n * can end short of exit 0 leaves a partial or empty local database, and none of\n * them may be reported as a copy. A non-zero exit is pg_restore saying it\n * skipped statements — \"errors ignored on restore: N\" — and whatever those\n * statements created (a table, its rows, an RLS policy) is missing locally.\n *\n * `started` says whether anything can have arrived, which is what decides\n * whether an anonymization pass still has data to redact.\n */\nexport function restoreOutcome(run: RestoreRun): { started: boolean; failure: string | null } {\n    if (run.signal) {\n        return { started: true, failure: `pg_restore was stopped by ${run.signal} before it finished.` };\n    }\n    if (run.exitCode === undefined) {\n        return { started: false, failure: `pg_restore could not be started (${run.code ?? \"unknown error\"}).` };\n    }\n    if (run.exitCode === 0) return { started: true, failure: null };\n\n    const ignored = /errors ignored on restore: (\\d+)/.exec(run.stderr ?? \"\");\n\n    return {\n        started: true,\n        failure: ignored\n            ? `pg_restore could not restore ${ignored[1]} object(s) — the errors are above.`\n            : `pg_restore exited with code ${run.exitCode}.`\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,qBAA0E;CACnF;EAAE,SAAS;EAAyB,aAAa;CAA+C;CAChG;EAAE,SAAS;EAA+C,aAAa;CAAiB;CACxF;EAAE,SAAS;EAAsE,aAAa;CAAa;CAC3G;EAAE,SAAS;EAAwD,aAAa;CAAa;CAC7F;EAAE,SAAS;EAAoD,aAAa;CAAa;CACzF;EAAE,SAAS;EAA2F,aAAa;CAAa;CAChI;EAAE,SAAS;EAA6C,aAAa;CAAa;AACtF;AAEA,SAAgB,gBAAgB,YAA6B;CACzD,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC;AAC1E;AAEA,SAAgB,eAAe,YAAmC;CAC9D,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC,CAAC,EAAE,eAAe;AAC5F;;;;;;;;;AAkBA,SAAgB,oBAAoB,SAA4C;CAC5E,MAAM,0BAAU,IAAI,IAAI;EAAC;EAAQ;EAAqB;EAAW;EAAa;EAAQ;CAAQ,CAAC;CAE/F,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,SAAS,YAAY,CAAC,CAAC;AAClH;;AAGA,SAAgB,oBAAoB,SAAyC;CACzE,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC/C,MAAM,MAAM,GAAG,OAAO,OAAO,GAAG,OAAO;EACvC,QAAQ,IAAI,KAAK,CAAC,GAAI,QAAQ,IAAI,GAAG,KAAK,CAAC,GAAI,MAAM,CAAC;CAC1D;CAEA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,OAAO,UAAU;EACpB,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,CACxB,MAAM,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC,CAAC,CAChD,KAAK,WAAW,IAAI,OAAO,OAAO,MAAM,eAAe,OAAO,MAAM,GAAG,CAAC,CACxE,KAAK,IAAI;EAEd,OAAO,UAAU,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,OAAO,YAAY;CAC9F,CAAC;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,MAA+C;CAChF,MAAM,QAAQ,SAAiB,SAAS,wBAAwB,KAAK,WAAW,KAAK;CAErF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;AAC1F;;AAGA,SAAgB,eAAe,kBAAkC;CAC7D,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,MAAM,WAAW,IAAI,SAAS,QAAQ,OAAO,EAAE,KAAK;EAEpD,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,GAAG;CAC/D,QAAQ;EAGJ,OAAO;CACX;AACJ;;;;;;;;;AAoBA,SAAgB,SAAS,MAA0B;CAC/C,MAAM,OAAO;EAAC;EAAmB;EAAc;EAAY;CAAiB;CAC5E,KAAK,MAAM,UAAU,KAAK,SAAS,KAAK,KAAK,YAAY,MAAM;CAC/D,KAAK,KAAK,YAAY,KAAK,MAAM;CAEjC,OAAO;AACX;;;;;;;;AASA,SAAgB,YAAY,MAAgB,UAA4B;CACpE,OAAO;EAAC;EAAW;EAAe;EAAc;EAAmB;EAAY,KAAK;EAAQ;CAAQ;AACxG;;;;;;;AAQA,eAAsB,WAAW,MAAwD;CACrF,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,MAAM,CAAC,WAAW,CAAC;EAElD,OAAO,OAAO,KAAK;CACvB,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;;AAuBA,SAAgB,eAAe,KAA+D;CAC1F,IAAI,IAAI,QACJ,OAAO;EAAE,SAAS;EAAM,SAAS,6BAA6B,IAAI,OAAO;CAAsB;CAEnG,IAAI,IAAI,aAAa,KAAA,GACjB,OAAO;EAAE,SAAS;EAAO,SAAS,oCAAoC,IAAI,QAAQ,gBAAgB;CAAI;CAE1G,IAAI,IAAI,aAAa,GAAG,OAAO;EAAE,SAAS;EAAM,SAAS;CAAK;CAE9D,MAAM,UAAU,mCAAmC,KAAK,IAAI,UAAU,EAAE;CAExE,OAAO;EACH,SAAS;EACT,SAAS,UACH,gCAAgC,QAAQ,GAAG,sCAC3C,+BAA+B,IAAI,SAAS;CACtD;AACJ"}

package/dist/{resolve-Y56osuQH.js → resolve-BAeRUBhg.js}

@@ -42,7 +42,7 @@ function resolveDevDatabase(input = {}) {
 		url: fromEnvFile,
 		source: "env-file"
 	};
-	if (input.flagDocker || input.manifestPreference === "docker") return {
+	if (input.flagDocker) return {
 		kind: "docker",
 		source: "docker",
 		url: present(input.composeUrl)
@@ -71,4 +71,4 @@ function describeDevDatabase(database) {
 //#endregion
 export { resolveDevDatabase as n, resolve_exports as r, describeDevDatabase as t };
 
-//# sourceMappingURL=resolve-Y56osuQH.js.map
+//# sourceMappingURL=resolve-BAeRUBhg.js.map

package/dist/resolve-BAeRUBhg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-BAeRUBhg.js","names":[],"sources":["../src/dev-db/resolve.ts"],"sourcesContent":["/**\n * Which database a command should talk to, decided in one place.\n *\n * Before this existed every command that needed Postgres read `DATABASE_URL`\n * for itself, which was fine while there was exactly one answer. Introducing a\n * managed database makes the question real: a project may have no\n * `DATABASE_URL` at all and still expect `rebase db push` to work, and a\n * project that *does* set one must never be quietly redirected somewhere else.\n *\n * So the rule is ordered and boring, and the order is the promise:\n *\n *   1. `--database-url <url>`   — said on this command line, wins over everything\n *   2. `DATABASE_URL` in the shell environment\n *   3. the database branch this checkout is switched to\n *   4. `DATABASE_URL` in the project's `.env`\n *   5. `--docker`\n *   6. the managed PGlite database\n *\n * An explicit connection string always wins. That is the whole point of the\n * override: someone pointing Rebase at their own Postgres — a colleague's\n * staging box, a Neon branch, a container they manage — must get exactly that,\n * with no cleverness in between. The managed database is what fills the vacuum\n * when nobody has said anything, and it is the only case where the CLI picks.\n *\n * The branch at (3) is the one addition that is not an explicit connection\n * string, and it sits where it does deliberately. It has to outrank `.env` or\n * `rebase db branch switch` would silently do nothing on every project that\n * sets `DATABASE_URL` — which is every project not on the managed database.\n * It must not outrank (1) or (2), because a flag on this command line and a\n * variable in this shell are more immediate than a switch made yesterday.\n *\n * {@link resolveDevDatabase} is pure: inputs in, decision out, no filesystem\n * and no process. Reading `.env`, reading the branch pointer and starting a\n * daemon happen elsewhere, so the ordering above can be tested without any of\n * them.\n */\n\n/** Where the answer came from. Carried so diagnostics can name it. */\nexport type DevDatabaseSource =\n    /** `--database-url` on the command line. */\n    | \"flag\"\n    /** `DATABASE_URL` in the shell environment. */\n    | \"environment\"\n    /** `DATABASE_URL` in the project's `.env`. */\n    | \"env-file\"\n    /** The branch this checkout is switched to, over the base connection. */\n    | \"branch\"\n    /** `--docker`. */\n    | \"docker\"\n    /** Nobody said anything, so the managed database fills in. */\n    | \"managed\";\n\nexport type DevDatabase =\n    | {\n        kind: \"external\";\n        /** The connection string, exactly as given. Never rewritten. */\n        url: string;\n        source: Extract<DevDatabaseSource, \"flag\" | \"environment\" | \"env-file\" | \"branch\">;\n        /** The branch name, when this checkout is switched to one. */\n        branch?: string;\n    }\n    | {\n        kind: \"docker\";\n        source: \"docker\";\n        /**\n         * The compose `db` service's connection string, derived by the caller.\n         *\n         * Null when the project has no compose file to derive one from, which\n         * is a `--docker` that cannot be honoured rather than a fallback: the\n         * caller says so instead of guessing at `localhost:5432`.\n         */\n        url: string | null;\n    }\n    | {\n        kind: \"managed\";\n        source: \"managed\";\n    };\n\nexport interface ResolveDevDatabaseInput {\n    /** `--database-url <url>`, if given. */\n    flagUrl?: string | null;\n    /** `--docker`, if given. */\n    flagDocker?: boolean;\n    /** The shell environment. Only `DATABASE_URL` is read. */\n    env?: Record<string, string | undefined>;\n    /** Parsed `.env` from the project root. Only `DATABASE_URL` is read. */\n    envFile?: Record<string, string> | null;\n    /**\n     * The compose `db` service's connection string, when the project has one.\n     *\n     * Passed in rather than read here so this function stays pure. Only\n     * consulted for the Docker case; an explicit `DATABASE_URL` still wins.\n     */\n    composeUrl?: string | null;\n    /**\n     * The branch this checkout is switched to, already resolved to a URL.\n     *\n     * Resolved by the caller rather than here so this stays pure: deriving it\n     * needs the base connection string, which needs the `.env` this function is\n     * handed rather than reads.\n     */\n    branch?: { name: string; url: string } | null;\n}\n\n/**\n * A value that is present but empty is treated as absent.\n *\n * `DATABASE_URL=` in a `.env` is what a developer writes when they mean \"not\n * this one\" — honouring it literally would hand an empty connection string to\n * libpq and produce an error about a missing host, which explains nothing.\n */\nfunction present(value: string | undefined | null): string | null {\n    if (typeof value !== \"string\") return null;\n    const trimmed = value.trim();\n\n    return trimmed.length > 0 ? trimmed : null;\n}\n\nexport function resolveDevDatabase(input: ResolveDevDatabaseInput = {}): DevDatabase {\n    const flagUrl = present(input.flagUrl);\n    if (flagUrl) return { kind: \"external\", url: flagUrl, source: \"flag\" };\n\n    const fromEnvironment = present(input.env?.DATABASE_URL);\n    if (fromEnvironment) return { kind: \"external\", url: fromEnvironment, source: \"environment\" };\n\n    // Above `.env`, below anything said explicitly — see the ordering note at\n    // the top of this file.\n    const fromBranch = present(input.branch?.url);\n    if (fromBranch && input.branch) {\n        return { kind: \"external\", url: fromBranch, source: \"branch\", branch: input.branch.name };\n    }\n\n    const fromEnvFile = present(input.envFile?.DATABASE_URL);\n    if (fromEnvFile) return { kind: \"external\", url: fromEnvFile, source: \"env-file\" };\n\n    // Only consulted once every explicit connection string is exhausted: asking\n    // for Docker is a choice about *how to get* a database, not which one, so a\n    // DATABASE_URL that already names one outranks it.\n    if (input.flagDocker) {\n        return { kind: \"docker\", source: \"docker\", url: present(input.composeUrl) };\n    }\n\n    return { kind: \"managed\", source: \"managed\" };\n}\n\n/** One line for the startup banner, naming both the database and why. */\nexport function describeDevDatabase(database: DevDatabase): string {\n    switch (database.kind) {\n        case \"external\":\n            switch (database.source) {\n                case \"flag\":\n                    return \"your database (--database-url)\";\n                case \"environment\":\n                    return \"your database (DATABASE_URL in the environment)\";\n                case \"env-file\":\n                    return \"your database (DATABASE_URL in .env)\";\n                case \"branch\":\n                    return `branch \"${database.branch}\" (rebase db branch switch)`;\n            }\n            break;\n        case \"docker\":\n            return \"Postgres in Docker\";\n        case \"managed\":\n            return \"the managed development database (PGlite)\";\n    }\n\n    // Unreachable while the union is exhaustive; kept so a future variant fails\n    // loudly in review rather than printing \"undefined\" to a user.\n    throw new Error(`Unhandled dev database: ${JSON.stringify(database)}`);\n}\n"],"mappings":";;;;;;;;;;;;;AA+GA,SAAS,QAAQ,OAAiD;CAC9D,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,UAAU,MAAM,KAAK;CAE3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AAC1C;AAEA,SAAgB,mBAAmB,QAAiC,CAAC,GAAgB;CACjF,MAAM,UAAU,QAAQ,MAAM,OAAO;CACrC,IAAI,SAAS,OAAO;EAAE,MAAM;EAAY,KAAK;EAAS,QAAQ;CAAO;CAErE,MAAM,kBAAkB,QAAQ,MAAM,KAAK,YAAY;CACvD,IAAI,iBAAiB,OAAO;EAAE,MAAM;EAAY,KAAK;EAAiB,QAAQ;CAAc;CAI5F,MAAM,aAAa,QAAQ,MAAM,QAAQ,GAAG;CAC5C,IAAI,cAAc,MAAM,QACpB,OAAO;EAAE,MAAM;EAAY,KAAK;EAAY,QAAQ;EAAU,QAAQ,MAAM,OAAO;CAAK;CAG5F,MAAM,cAAc,QAAQ,MAAM,SAAS,YAAY;CACvD,IAAI,aAAa,OAAO;EAAE,MAAM;EAAY,KAAK;EAAa,QAAQ;CAAW;CAKjF,IAAI,MAAM,YACN,OAAO;EAAE,MAAM;EAAU,QAAQ;EAAU,KAAK,QAAQ,MAAM,UAAU;CAAE;CAG9E,OAAO;EAAE,MAAM;EAAW,QAAQ;CAAU;AAChD;;AAGA,SAAgB,oBAAoB,UAA+B;CAC/D,QAAQ,SAAS,MAAjB;EACI,KAAK;GACD,QAAQ,SAAS,QAAjB;IACI,KAAK,QACD,OAAO;IACX,KAAK,eACD,OAAO;IACX,KAAK,YACD,OAAO;IACX,KAAK,UACD,OAAO,WAAW,SAAS,OAAO;GAC1C;GACA;EACJ,KAAK,UACD,OAAO;EACX,KAAK,WACD,OAAO;CACf;CAIA,MAAM,IAAI,MAAM,2BAA2B,KAAK,UAAU,QAAQ,GAAG;AACzE"}

package/dist/upgrade.d.ts

@@ -25,6 +25,11 @@ export type SpecClass =
     kind: "local";
     protocol: "link:" | "file:" | "portal:";
 }
+/** A pnpm `catalog:` reference: the version is in pnpm-workspace.yaml's catalog, and moves there. */
+ | {
+    kind: "catalog";
+    catalog: string;
+}
 /** Anything else, with the reason it is left alone. */
  | {
     kind: "other";
@@ -55,11 +60,13 @@ export interface ProjectFiles {
 }
 /** Every `package.json` and `pnpm-workspace.yaml` under the project root. */
 export declare function discoverProjectFiles(projectRoot: string): ProjectFiles;
+/** Where a catalog pin sits: `catalog`, or `catalogs.<name>` for a named one. */
+export type CatalogField = "catalog" | `catalogs.${string}`;
 export interface ChangedPin {
     /** Relative to the project root, POSIX separators. */
     file: string;
     name: string;
-    field: PinField;
+    field: PinField | CatalogField;
     from: string;
     to: string;
 }
@@ -97,6 +104,8 @@ export interface UpgradePlan {
         absolute: string;
         content: string;
     }>;
+    /** Pins, overrides and catalog entries that were already on the target. */
+    unchanged: number;
 }
 export interface PlanOptions {
     /** Remove `link:`/`file:` overrides of framework packages instead of reporting them. */

package/dist/utils/tool-stdio.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The stdio a build tool the CLI runs in the foreground gets: a static app's
+ * build command, `tsc`, `tar`.
+ *
+ * Inherited, so its output streams as it happens. With `quietStdout` its stdout
+ * goes to stderr instead, for a command whose own stdout carries a result:
+ * `rebase cloud deploy` in JSON mode — every piped run — owes stdout exactly one
+ * JSON value, and a `vite v6 building…` line in front of it is a result no
+ * parser can read. The tool's output still reaches the person watching.
+ */
+export declare function toolStdio(quietStdout: boolean | undefined): "inherit" | ["ignore", 2, "inherit"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.21.2-canary.g1ea48be",
+  "version": "0.23.0",
   "description": "Developer tools for Rebase projects",
   "keywords": [
     "cli",
@@ -43,12 +43,12 @@
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
     "pg": "^8.22.0",
-    "@rebasepro/agent-skills": "0.21.2-canary.g1ea48be",
-    "@rebasepro/server": "0.21.2-canary.g1ea48be",
-    "@rebasepro/codegen": "0.21.2-canary.g1ea48be",
-    "@rebasepro/server-postgres": "0.21.2-canary.g1ea48be",
-    "@rebasepro/client": "0.21.2-canary.g1ea48be",
-    "@rebasepro/types": "0.21.2-canary.g1ea48be"
+    "@rebasepro/agent-skills": "0.23.0",
+    "@rebasepro/client": "0.23.0",
+    "@rebasepro/codegen": "0.23.0",
+    "@rebasepro/server": "0.23.0",
+    "@rebasepro/types": "0.23.0",
+    "@rebasepro/server-postgres": "0.23.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
@@ -56,7 +56,7 @@
     "@types/ws": "^8.18.1",
     "typescript": "^6.0.3",
     "vite": "^8.1.5",
-    "vitest": "4.1.10",
+    "vitest": "4.1.11",
     "ws": "^8.21.1"
   },
   "files": [

package/dist/resolve-Y56osuQH.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve-Y56osuQH.js","names":[],"sources":["../src/dev-db/resolve.ts"],"sourcesContent":["/**\n * Which database a command should talk to, decided in one place.\n *\n * Before this existed every command that needed Postgres read `DATABASE_URL`\n * for itself, which was fine while there was exactly one answer. Introducing a\n * managed database makes the question real: a project may have no\n * `DATABASE_URL` at all and still expect `rebase db push` to work, and a\n * project that *does* set one must never be quietly redirected somewhere else.\n *\n * So the rule is ordered and boring, and the order is the promise:\n *\n *   1. `--database-url <url>`   — said on this command line, wins over everything\n *   2. `DATABASE_URL` in the shell environment\n *   3. the database branch this checkout is switched to\n *   4. `DATABASE_URL` in the project's `.env`\n *   5. `--docker` / a manifest preference of `docker`\n *   6. the managed PGlite database\n *\n * An explicit connection string always wins. That is the whole point of the\n * override: someone pointing Rebase at their own Postgres — a colleague's\n * staging box, a Neon branch, a container they manage — must get exactly that,\n * with no cleverness in between. The managed database is what fills the vacuum\n * when nobody has said anything, and it is the only case where the CLI picks.\n *\n * The branch at (3) is the one addition that is not an explicit connection\n * string, and it sits where it does deliberately. It has to outrank `.env` or\n * `rebase db branch switch` would silently do nothing on every project that\n * sets `DATABASE_URL` — which is every project not on the managed database.\n * It must not outrank (1) or (2), because a flag on this command line and a\n * variable in this shell are more immediate than a switch made yesterday.\n *\n * {@link resolveDevDatabase} is pure: inputs in, decision out, no filesystem\n * and no process. Reading `.env`, reading the branch pointer and starting a\n * daemon happen elsewhere, so the ordering above can be tested without any of\n * them.\n */\n\n/** Where the answer came from. Carried so diagnostics can name it. */\nexport type DevDatabaseSource =\n    /** `--database-url` on the command line. */\n    | \"flag\"\n    /** `DATABASE_URL` in the shell environment. */\n    | \"environment\"\n    /** `DATABASE_URL` in the project's `.env`. */\n    | \"env-file\"\n    /** The branch this checkout is switched to, over the base connection. */\n    | \"branch\"\n    /** `--docker`, or `devDatabase: \"docker\"` in the manifest. */\n    | \"docker\"\n    /** Nobody said anything, so the managed database fills in. */\n    | \"managed\";\n\nexport type DevDatabase =\n    | {\n        kind: \"external\";\n        /** The connection string, exactly as given. Never rewritten. */\n        url: string;\n        source: Extract<DevDatabaseSource, \"flag\" | \"environment\" | \"env-file\" | \"branch\">;\n        /** The branch name, when this checkout is switched to one. */\n        branch?: string;\n    }\n    | {\n        kind: \"docker\";\n        source: \"docker\";\n        /**\n         * The compose `db` service's connection string, derived by the caller.\n         *\n         * Null when the project has no compose file to derive one from, which\n         * is a `--docker` that cannot be honoured rather than a fallback: the\n         * caller says so instead of guessing at `localhost:5432`.\n         */\n        url: string | null;\n    }\n    | {\n        kind: \"managed\";\n        source: \"managed\";\n    };\n\nexport interface ResolveDevDatabaseInput {\n    /** `--database-url <url>`, if given. */\n    flagUrl?: string | null;\n    /** `--docker`, if given. */\n    flagDocker?: boolean;\n    /** The shell environment. Only `DATABASE_URL` is read. */\n    env?: Record<string, string | undefined>;\n    /** Parsed `.env` from the project root. Only `DATABASE_URL` is read. */\n    envFile?: Record<string, string> | null;\n    /** `devDatabase` from `rebase.json`, if the project recorded a preference. */\n    manifestPreference?: \"managed\" | \"docker\" | null;\n    /**\n     * The compose `db` service's connection string, when the project has one.\n     *\n     * Passed in rather than read here so this function stays pure. Only\n     * consulted for the Docker case; an explicit `DATABASE_URL` still wins.\n     */\n    composeUrl?: string | null;\n    /**\n     * The branch this checkout is switched to, already resolved to a URL.\n     *\n     * Resolved by the caller rather than here so this stays pure: deriving it\n     * needs the base connection string, which needs the `.env` this function is\n     * handed rather than reads.\n     */\n    branch?: { name: string; url: string } | null;\n}\n\n/**\n * A value that is present but empty is treated as absent.\n *\n * `DATABASE_URL=` in a `.env` is what a developer writes when they mean \"not\n * this one\" — honouring it literally would hand an empty connection string to\n * libpq and produce an error about a missing host, which explains nothing.\n */\nfunction present(value: string | undefined | null): string | null {\n    if (typeof value !== \"string\") return null;\n    const trimmed = value.trim();\n\n    return trimmed.length > 0 ? trimmed : null;\n}\n\nexport function resolveDevDatabase(input: ResolveDevDatabaseInput = {}): DevDatabase {\n    const flagUrl = present(input.flagUrl);\n    if (flagUrl) return { kind: \"external\", url: flagUrl, source: \"flag\" };\n\n    const fromEnvironment = present(input.env?.DATABASE_URL);\n    if (fromEnvironment) return { kind: \"external\", url: fromEnvironment, source: \"environment\" };\n\n    // Above `.env`, below anything said explicitly — see the ordering note at\n    // the top of this file.\n    const fromBranch = present(input.branch?.url);\n    if (fromBranch && input.branch) {\n        return { kind: \"external\", url: fromBranch, source: \"branch\", branch: input.branch.name };\n    }\n\n    const fromEnvFile = present(input.envFile?.DATABASE_URL);\n    if (fromEnvFile) return { kind: \"external\", url: fromEnvFile, source: \"env-file\" };\n\n    // Only consulted once every explicit connection string is exhausted: asking\n    // for Docker is a choice about *how to get* a database, not which one, so a\n    // DATABASE_URL that already names one outranks it.\n    if (input.flagDocker || input.manifestPreference === \"docker\") {\n        return { kind: \"docker\", source: \"docker\", url: present(input.composeUrl) };\n    }\n\n    return { kind: \"managed\", source: \"managed\" };\n}\n\n/** One line for the startup banner, naming both the database and why. */\nexport function describeDevDatabase(database: DevDatabase): string {\n    switch (database.kind) {\n        case \"external\":\n            switch (database.source) {\n                case \"flag\":\n                    return \"your database (--database-url)\";\n                case \"environment\":\n                    return \"your database (DATABASE_URL in the environment)\";\n                case \"env-file\":\n                    return \"your database (DATABASE_URL in .env)\";\n                case \"branch\":\n                    return `branch \"${database.branch}\" (rebase db branch switch)`;\n            }\n            break;\n        case \"docker\":\n            return \"Postgres in Docker\";\n        case \"managed\":\n            return \"the managed development database (PGlite)\";\n    }\n\n    // Unreachable while the union is exhaustive; kept so a future variant fails\n    // loudly in review rather than printing \"undefined\" to a user.\n    throw new Error(`Unhandled dev database: ${JSON.stringify(database)}`);\n}\n"],"mappings":";;;;;;;;;;;;;AAiHA,SAAS,QAAQ,OAAiD;CAC9D,IAAI,OAAO,UAAU,UAAU,OAAO;CACtC,MAAM,UAAU,MAAM,KAAK;CAE3B,OAAO,QAAQ,SAAS,IAAI,UAAU;AAC1C;AAEA,SAAgB,mBAAmB,QAAiC,CAAC,GAAgB;CACjF,MAAM,UAAU,QAAQ,MAAM,OAAO;CACrC,IAAI,SAAS,OAAO;EAAE,MAAM;EAAY,KAAK;EAAS,QAAQ;CAAO;CAErE,MAAM,kBAAkB,QAAQ,MAAM,KAAK,YAAY;CACvD,IAAI,iBAAiB,OAAO;EAAE,MAAM;EAAY,KAAK;EAAiB,QAAQ;CAAc;CAI5F,MAAM,aAAa,QAAQ,MAAM,QAAQ,GAAG;CAC5C,IAAI,cAAc,MAAM,QACpB,OAAO;EAAE,MAAM;EAAY,KAAK;EAAY,QAAQ;EAAU,QAAQ,MAAM,OAAO;CAAK;CAG5F,MAAM,cAAc,QAAQ,MAAM,SAAS,YAAY;CACvD,IAAI,aAAa,OAAO;EAAE,MAAM;EAAY,KAAK;EAAa,QAAQ;CAAW;CAKjF,IAAI,MAAM,cAAc,MAAM,uBAAuB,UACjD,OAAO;EAAE,MAAM;EAAU,QAAQ;EAAU,KAAK,QAAQ,MAAM,UAAU;CAAE;CAG9E,OAAO;EAAE,MAAM;EAAW,QAAQ;CAAU;AAChD;;AAGA,SAAgB,oBAAoB,UAA+B;CAC/D,QAAQ,SAAS,MAAjB;EACI,KAAK;GACD,QAAQ,SAAS,QAAjB;IACI,KAAK,QACD,OAAO;IACX,KAAK,eACD,OAAO;IACX,KAAK,YACD,OAAO;IACX,KAAK,UACD,OAAO,WAAW,SAAS,OAAO;GAC1C;GACA;EACJ,KAAK,UACD,OAAO;EACX,KAAK,WACD,OAAO;CACf;CAIA,MAAM,IAAI,MAAM,2BAA2B,KAAK,UAAU,QAAQ,GAAG;AACzE"}